SOPlanning 1.55 exposed by seven CVEs
CERT Polska coordinated disclosure of seven vulnerabilities in SOPlanning 1.55 and below, including unauthenticated backup access, SQL injection, and arbitrary file upload leading to RCE.
CERT Polska has coordinated the disclosure of seven vulnerabilities affecting SOPlanning version 1.55 and below, a project planning and scheduling application. The most critical flaw, CVE-2026-40543, allows unauthenticated attackers to access backup endpoints and retrieve database archives containing user credentials and sensitive configuration data without any authorization checks.
The vulnerability chain becomes particularly dangerous when combined: CVE-2026-40548 permits authenticated attackers to upload arbitrary files disguised within backup archives, CVE-2026-40547 enables path traversal to place these files in web-accessible locations, and the missing authorization check allows unauthenticated exploitation of the complete chain for potential remote code execution. Additional vulnerabilities include SQL injection across multiple endpoints (CVE-2026-40546), stored XSS via backup upload (CVE-2026-40544), reflected XSS via the taches parameter (CVE-2026-40545), and CSRF in group management functions (CVE-2026-40549).
The vulnerabilities were responsibly disclosed by researcher Łukasz Jaworski through CERT Polska's coordinated vulnerability disclosure process. Organizations running SOPlanning 1.55 or earlier should prioritize patching, particularly given the critical authentication bypass that exposes sensitive backup data to any network-accessible attacker.
Mentioned in this report
Detection guidance
SOPlanning Backup Endpoint Path Traversal Exploitation Attempt
Detects path traversal sequences in requests to SOPlanning backup/upload endpoints, consistent with CVE-2026-40547/40548 file-placement exploitation chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Backup Endpoint Path Traversal Exploitation Attempt
id: 63cf8f4b-ddf7-5de3-853d-68759766eafb
status: experimental
description: Detects path traversal sequences (../, encoded variants) in URI query
or path targeting SOPlanning backup/restore/upload endpoints, consistent with the
CVE-2026-40547 path traversal combined with CVE-2026-40548 arbitrary file upload
used to place a web-accessible payload.
references:
- CERT Polska SOPlanning 1.55 disclosure
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /backup
- /save
- /import
traversal:
cs-uri-query|contains:
- ../
- ..\\
- ..%2f
- ..%5c
- '%2e%2e%2f'
condition: selection and traversal
falsepositives:
- Legitimate admin restore operations that reference nested backup directory structures
(rare, should still be reviewed)
level: high
tags:
- attack.t1190
- attack.t1212
SOPlanning Unauthenticated Backup Archive Access
Detects direct HTTP access to SOPlanning backup archive files/endpoints, consistent with CVE-2026-40543 missing authorization check allowing unauthenticated retrieval of database backups containing credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Unauthenticated Backup Archive Access
id: 0fbeba69-8d00-592d-9257-26d8679c39b0
status: experimental
description: Detects HTTP requests retrieving SOPlanning backup archive files (sql/zip/tar
dumps) from backup/save endpoints, matching the pattern used to exploit CVE-2026-40543
where no authorization check gates access to sensitive backup data.
references:
- CERT Polska SOPlanning 1.55 disclosure
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /backup/
- /save/
cs-uri-stem|endswith:
- .sql
- .sql.gz
- .zip
- .tar.gz
condition: selection
falsepositives:
- Authenticated administrators downloading scheduled backups through the normal application
UI
- Automated backup jobs configured to pull archives over HTTP for offsite storage
level: medium
tags:
- attack.t1212
- attack.t1190
Web Server Process Spawning Unix Shell (Possible Web Shell RCE)
Detects a web server or PHP-FPM process spawning a shell interpreter, consistent with post-exploitation command execution after an uploaded PHP file (e.g. via the SOPlanning backup upload chain CVE-2026-40547/40548) is invoked as a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Unix Shell (Possible Web Shell RCE)
id: f5297b02-65d7-5f10-8108-41044cc3e84b
status: experimental
description: Detects Apache, nginx, or PHP-FPM worker processes spawning a Unix shell,
a common indicator of a web shell executing attacker-supplied commands after arbitrary
file upload/path traversal exploitation such as chained SOPlanning CVE-2026-40543/40547/40548.
references:
- CERT Polska SOPlanning 1.55 disclosure
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
condition: selection
falsepositives:
- Legitimate application maintenance scripts invoked by the web server via CGI or
cron-triggered hooks
- Health-check or deployment scripts that shell out from the web server process
level: high
tags:
- attack.t1059.004
- attack.t1190
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40543
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free